Store number of axis in Parcel to prevent infinite loop

BUG=25637534

Change-Id: Id3ca2fe12a4c45280bce65ee60906b8eeb63a530

1 files changed, 11 insertions, 8 deletions

diff --git a/core/java/android/view/InputDevice.java b/core/java/android/view/InputDevice.java
index 88cd7ca71a4e..281ab12df4b7 100644
--- a/core/java/android/view/InputDevice.java
+++ b/core/java/android/view/InputDevice.java
@@ -383,6 +383,8 @@ public final class InputDevice implements Parcelable {
      */
     public static final int KEYBOARD_TYPE_ALPHABETIC = 2;
 
+    private static final int MAX_RANGES = 1000;
+
     public static final Parcelable.Creator<InputDevice> CREATOR =
             new Parcelable.Creator<InputDevice>() {
         public InputDevice createFromParcel(Parcel in) {
@@ -432,13 +434,14 @@ public final class InputDevice implements Parcelable {
         mHasButtonUnderPad = in.readInt() != 0;
         mIdentifier = new InputDeviceIdentifier(mDescriptor, mVendorId, mProductId);
 
-        for (;;) {
-            int axis = in.readInt();
-            if (axis < 0) {
-                break;
-            }
-            addMotionRange(axis, in.readInt(), in.readFloat(), in.readFloat(), in.readFloat(),
-                    in.readFloat(), in.readFloat());
+        int numRanges = in.readInt();
+        if (numRanges > MAX_RANGES) {
+            numRanges = MAX_RANGES;
+        }
+
+        for (int i = 0; i < numRanges; i++) {
+            addMotionRange(in.readInt(), in.readInt(), in.readFloat(), in.readFloat(),
+                    in.readFloat(), in.readFloat(), in.readFloat());
         }
     }
 
@@ -921,6 +924,7 @@ public final class InputDevice implements Parcelable {
         out.writeInt(mHasButtonUnderPad ? 1 : 0);
 
         final int numRanges = mMotionRanges.size();
+        out.writeInt(numRanges);
         for (int i = 0; i < numRanges; i++) {
             MotionRange range = mMotionRanges.get(i);
             out.writeInt(range.mAxis);
@@ -931,7 +935,6 @@ public final class InputDevice implements Parcelable {
             out.writeFloat(range.mFuzz);
             out.writeFloat(range.mResolution);
         }
-        out.writeInt(-1);
     }
 
     @Override